xfree86: Take second reference for SavedCursor in xf86CursorSetCursor
The same pointer is kept in CurrentCursor as well, therefore two RefCursor calls are needed. Fixes use-after-free after switching VTs. Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1067
This commit is contained in:
parent
2902b78535
commit
919f1f46fc
|
@ -334,6 +334,9 @@ xf86CursorSetCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCurs,
|
||||||
ScreenPriv->HotY = cursor->bits->yhot;
|
ScreenPriv->HotY = cursor->bits->yhot;
|
||||||
|
|
||||||
if (!infoPtr->pScrn->vtSema) {
|
if (!infoPtr->pScrn->vtSema) {
|
||||||
|
cursor = RefCursor(cursor);
|
||||||
|
if (ScreenPriv->SavedCursor)
|
||||||
|
FreeCursor(ScreenPriv->SavedCursor, None);
|
||||||
ScreenPriv->SavedCursor = cursor;
|
ScreenPriv->SavedCursor = cursor;
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue